pirikara/Supply Chain Guard
Multi-ecosystem frozen install check + GitHub Advisory (malware) + OSSF malicious packages + GuardDog analysis
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| enable-ossf | Check against OpenSSF malicious-packages (warn) | — | true |
| enable-guarddog | Run GuardDog npm scan via Docker (heuristics: typo, suspicious install scripts, etc.) | — | false |
| guarddog-fail | Fail the job when GuardDog finds findings (>0) | — | false |
| pr-comment | Comment security scan results summary on PR | — | false |
| warn-only | Warn (do not fail) for: minimumAge / OpenSSF / GuardDog | — | true |
| workdir | Working directory (where package.json/lockfile live) | — | . |
Outputs
| name | description |
|---|---|
| changed-count | Count of changed deps in this PR (from dep-diff) |
| malware-hits-count | Count of GH Advisory (type: malware) hits (best-effort) |
| guarddog-findings-count | Count of GuardDog findings (best-effort) |